Bug 2138015 (CVE-2022-39307) - CVE-2022-39307 grafana: User enumeration via forget password
Summary: CVE-2022-39307 grafana: User enumeration via forget password
Keywords:
Status: NEW
Alias: CVE-2022-39307
Product: Security Response
Classification: Other
Component: vulnerability
Version: unspecified
Hardware: All
OS: Linux
medium
medium
Target Milestone: ---
Assignee: Nobody
QA Contact:
URL:
Whiteboard:
Depends On: 2138034 2138035 2138036 2138070 2138071 2138265 2141185
Blocks: 2137894
TreeView+ depends on / blocked
 
Reported: 2022-10-26 21:24 UTC by Nick Tait
Modified: 2024-05-03 18:49 UTC (History)
44 users (show)

Fixed In Version: grafana 9.2.4 grafana 8.5.15
Doc Type: If docs needed, set a value
Doc Text:
An information leak was discovered in Grafana. Remote unauthenticated users could exploit the forget password feature to discover which user accounts exist.
Clone Of:
Environment:
Last Closed:
Embargoed:

Attachments (Terms of Use)


Links
System ID Private Priority Status Summary Last Updated
Red Hat Product Errata RHSA-2023:3642 0 None None None 2023-06-15 16:01:19 UTC
Red Hat Product Errata RHSA-2023:6420 0 None None None 2023-11-07 08:16:21 UTC

Description Nick Tait 2022-10-26 21:24:23 UTC 
When using the forget password on the login page, a POST request is made to the `/api/user/password/sent-reset-email` URL. When the username or email does not exist, the JSON response contains a “user not found” message which leaks information about which accounts already exist.

Affected Versions: 
Grafana <=8.x, Grafana <=9.x
Comment 1 Sage McTaggart 2022-10-27 00:01:31 UTC 
Deptopia refers to version 5.2.3-4.el7cp for ceph 3 (which matches with a manual search of the most recent release's source code), thus affected and OOOS, and uses Grafana container for Ceph 4 and 5.  

Grafana container:  
Ceph 4.x uses golang:1.11.4 as the base to get grafana from. This was released significantly prior to the bugs in 9.2.0 and 9.2.1, but 5.x<=8.x to affected and trackers filed. 

Ceph 5.3 (RC and thus the only potentially affected version) uses Grafana 8.3.5, and all the potential bug fixes are from prior to the http://tracker.ceph.com/issues/48*, which is when the affected timeline begins. 

Ceph 5.2 (most recent published verison) uses Grafana 8.3.5 and https://pkg.go.dev/github.com/grafana/grafana (from golang olang:1.17.6-alpine3.15), in the grafana container, published in 2019.
Thus, affected as 8.3.5 <= 8.x

In the case of gluster. Last release was in Feb. I also dug into the source code for gluster, we're running 5.2.4 as Deptopia verifies. 5.x<=8.x, so marked as affected and trackers filed.
Comment 6 Avinash Hanwate 2022-11-09 04:45:07 UTC 
Created grafana tracking bugs for this issue:

Affects: fedora-all [bug 2141185]
Comment 21 errata-xmlrpc 2023-06-15 16:01:15 UTC 
This issue has been addressed in the following products:

  Red Hat Ceph Storage 6.1

Via RHSA-2023:3642 https://access.redhat.com/errata/RHSA-2023:3642
Comment 23 errata-xmlrpc 2023-11-07 08:16:19 UTC 
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 9

Via RHSA-2023:6420 https://access.redhat.com/errata/RHSA-2023:6420
Note You need to log in before you can comment on or make changes to this bug.